A DevOps team uses Google Cloud Build to run automated tests and build container images for a critical application. The organization's security policy requires shifting security left by validating that container images do not contain severe vulnerabilities before they are stored in the artifact repository. The team has the following requirements: Scan locally built container images for OS and application language package vulnerabilities directly within the CI/CD pipeline. Automatically halt the build and prevent the image from being pushed to Artifact Registry if any CRITICAL or HIGH severity vulnerabilities are detected. Which strategy should the team implement in their Cloud Build configuration?

Configure build steps in `cloudbuild.yaml` to execute `gcloud artifacts docker images scan` on the local image, evaluate the results using `gcloud artifacts docker images list-vulnerabilities`, and fail the pipeline prior to executing `docker push` if matching severity levels are found.: ### What On-Demand Scanning in Cloud Build is **Artifact Analysis On-Demand Scanning** allows developers and CI/CD pipelines to initiate vulnerability scans on container images stored locally or in **Artifact Registry**. By leveraging the Google Cloud SDK within **Cloud Build**, organizations can scan images as a build step immediately after compilation and containerization. ### How it meets the requirements - **Shifting security left**: Scanning the local container before uploading ensures that security assessments happen immediately after artifact creation and before publication. - **Blocking vulnerable artifacts**: By running `gcloud artifacts docker images scan` followed by `gcloud artifacts docker images list-vulnerabilities`, the build pipeline can parse the effective severity levels. If vulnerabilities matching `CRITICAL` or `HIGH` are discovered, the script exits with a non-zero code, failing the build and preventing subsequent `docker push` execution. - **Comprehensive package scanning**: On-Demand Scanning analyzes both base operating system packages and language-level dependencies (such as Java, Go, Python, and Node.js) against a centralized vulnerability database. ### Key advantages and capabilities - **Pre-upload validation**: Guarantees that untrusted or vulnerable container layers never enter the centralized Artifact Registry repository. - **Granular policy gating**: Enables custom filtering rules and regex matching against specific Common Vulnerability Scoring System (CVSS) scores or severity categories. - **Automated integration**: Integrates natively with standard Cloud Build service accounts and builders without requiring third-party scanning infrastructure. - **Audit readiness**: Generates verifiable scan IDs and occurrences that can be reviewed in logs and security dashboards. ### Why this is optimal This approach directly prevents vulnerable images from reaching the repository, saving storage and network overhead while establishing a clean separation between validated release candidates and failed builds.

StudyCerts

Cloud Build On Demand Vulnerability Scanning | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Build On Demand Vulnerability Scanning

Section: Testing and validation of software and infrastructure

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A DevOps team uses Google Cloud Build to run automated tests and build container images for a critical application. The organization's security policy requires shifting security left by validating that container images do not contain severe vulnerabilities before they are stored in the artifact repository.

The team has the following requirements:

Scan locally built container images for OS and application language package vulnerabilities directly within the CI/CD pipeline.
Automatically halt the build and prevent the image from being pushed to Artifact Registry if any CRITICAL or HIGH severity vulnerabilities are detected.

Which strategy should the team implement in their Cloud Build configuration?

Configure build steps in cloudbuild.yaml to execute gcloud artifacts docker images scan on the local image, evaluate the results using gcloud artifacts docker images list-vulnerabilities, and fail the pipeline prior to executing docker push if matching severity levels are found.

Enable automatic vulnerability scanning in Artifact Registry, push all built container images immediately after unit testing, and trigger a Cloud Function via Pub/Sub to delete the image if vulnerabilities are discovered.

Incorporate a Web Security Scanner execution step into cloudbuild.yaml to scan the local container image filesystem for CVEs and halt the build upon detection of high-risk vulnerabilities.

Configure a Binary Authorization policy inside Cloud Build that evaluates the local Docker build context and prevents the Docker daemon from outputting image layers that contain critical vulnerabilities.

Professional Cloud Architect

Cloud Build On Demand Vulnerability Scanning

Related questions